test(#169): cover realPathOrNearest fallbacks and ReadFileTool handlePartial boundary

Author: proyectoauraorg

src/core/tools/__tests__/readFileTool.spec.ts

@@ -259,6 +259,27 @@ describe("ReadFileTool", () => {
 				expect.objectContaining({ tool: "readFile", isOutsideWorkspace: true }),
 			)
 		})
+
+		it("resolves the boundary through symlink resolution in handlePartial", async () => {
+			vi.mocked(isPathOutsideWorkspace).mockReturnValue(true)
+			const mockTask = createMockTask({ allowSymlinksOutsideWorkspace: false })
+
+			const block = {
+				type: "tool_use",
+				name: "read_file",
+				params: {},
+				partial: true,
+				nativeArgs: { path: "link-to-outside.txt" },
+			} as any
+
+			await readFileTool.handlePartial(mockTask as any, block)
+
+			const toolAsk = (mockTask.ask.mock.calls as any[]).find(([type]: [string]) => type === "tool")
+			expect(toolAsk).toBeDefined()
+			expect(JSON.parse(toolAsk![1] as string)).toEqual(
+				expect.objectContaining({ tool: "readFile", isOutsideWorkspace: true }),
+			)
+		})
 	})
 
 	describe("input validation", () => {

src/utils/__tests__/pathUtils.spec.ts

@@ -105,6 +105,48 @@ describe("isPathOutsideWorkspace", () => {
 		}
 	})
 
+	it("falls back to the lexical path when no ancestor resolves up to the root (#169)", () => {
+		const inside = path.join(workspaceDir, "a", "b", "new-file.ts")
+
+		// Force realpath to report ENOENT for every segment, so the walk-up reaches the
+		// filesystem root without resolving anything and falls back to the lexical path.
+		// Both the target and the workspace folder resolve lexically, so containment holds.
+		const spy = vi.spyOn(fs.realpathSync, "native").mockImplementation(() => {
+			const err: NodeJS.ErrnoException = new Error("no entry")
+			err.code = "ENOENT"
+			throw err
+		})
+
+		try {
+			expect(isPathOutsideWorkspace(inside)).toBe(false)
+		} finally {
+			spy.mockRestore()
+		}
+	})
+
+	it("treats a path as outside when the workspace folder itself cannot be resolved (#169)", () => {
+		const inside = path.join(workspaceDir, "file.ts")
+		fs.writeFileSync(inside, "x")
+
+		// The target resolves fine, but realpath on the workspace folder throws EACCES.
+		// A folder that can't be resolved can't prove containment, so we fail closed.
+		const realNative = fs.realpathSync.native
+		const spy = vi.spyOn(fs.realpathSync, "native").mockImplementation(((p: string) => {
+			if (p === workspaceDir) {
+				const err: NodeJS.ErrnoException = new Error("permission denied")
+				err.code = "EACCES"
+				throw err
+			}
+			return realNative(p)
+		}) as typeof fs.realpathSync.native)
+
+		try {
+			expect(isPathOutsideWorkspace(inside)).toBe(true)
+		} finally {
+			spy.mockRestore()
+		}
+	})
+
 	it("returns true when there are no workspace folders", () => {
 		mockWorkspace.folders = []
 		expect(isPathOutsideWorkspace(path.join(workspaceDir, "file.ts"))).toBe(true)